CVE-2021-32820
📋 TL;DR
CVE-2021-32820 is a file disclosure vulnerability in express-handlebars where the layout parameter can be manipulated to read arbitrary files with existing extensions. This affects Express.js applications using express-handlebars as their template engine. Attackers can potentially access sensitive files like configuration files or source code.
💻 Affected Systems
- express-handlebars
📦 What is this software?
Express Handlebars by Express Handlebars Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system disclosure including sensitive configuration files, environment variables, and source code leading to full system compromise.
Likely Case
Disclosure of application configuration files, source code, and potentially sensitive data files stored in accessible directories.
If Mitigated
Limited file access restricted to files with specific extensions in accessible directories only.
🎯 Exploit Status
Exploitation requires user input to reach the layout parameter. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.3.1 and later
Vendor Advisory: https://github.com/express-handlebars/express-handlebars/security/advisories/GHSA-8j79-7ghw-2w63
Restart Required: Yes
Instructions:
1. Update express-handlebars package: npm update express-handlebars
2. Verify version is 5.3.1 or higher: npm list express-handlebars
3. Restart your Express.js application
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize user input before passing to layout parameter
Disable Layout Parameter
allAvoid using dynamic layout parameters from user input
🧯 If You Can't Patch
- Implement strict input validation on all user-controlled parameters
- Use application-level firewalls to block suspicious file path patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list express-handlebars | grep express-handlebarsCheck Version:
npm list express-handlebarsVerify Fix Applied:
Confirm version is 5.3.1 or higher: npm list express-handlebars📡 Detection & Monitoring
Log Indicators:
- Unusual file path patterns in layout parameter requests
- Multiple failed attempts to access system files
Network Indicators:
- HTTP requests with suspicious path traversal patterns in layout parameter
SIEM Query:
source="web_server" AND (layout="*../*" OR layout="*..\\*" OR layout="*/etc/*" OR layout="*\\windows\\*" OR layout="*.env" OR layout="*.config")🔗 References
- https://github.com/express-handlebars/express-handlebars/blob/78c47a235c4ad7bc2674bddd8ec2721567ed8c72/README.md#danger-
- https://github.com/express-handlebars/express-handlebars/commit/78c47a235c4ad7bc2674bddd8ec2721567ed8c72
- https://github.com/express-handlebars/express-handlebars/pull/163
- https://securitylab.github.com/advisories/GHSL-2021-018-express-handlebars/
- https://www.npmjs.com/package/express-handlebars
- https://github.com/express-handlebars/express-handlebars/blob/78c47a235c4ad7bc2674bddd8ec2721567ed8c72/README.md#danger-
- https://github.com/express-handlebars/express-handlebars/commit/78c47a235c4ad7bc2674bddd8ec2721567ed8c72
- https://github.com/express-handlebars/express-handlebars/pull/163
- https://securitylab.github.com/advisories/GHSL-2021-018-express-handlebars/
- https://www.npmjs.com/package/express-handlebars
